How do I write the regex to capture the database name and major version from my sample data?

[vinay4444]

I am struggling with the regex match on the below pattern. I need to capture major version name from below ( DB2 9.7,DB2 10.1 ) . Pretty much first letter till second "." . Any help?

DB2 9.7.10.1
DB2 10.1.4.4
DB2 9.7.600.413
DB2 9.7.9.8

[Sebastian2]

No look all in:

# To extract the Version like "x.y" only:
/DB2\s(\d+\.\d+).*/i
# To extract the whole thing like "DB2 x.y"
/(DB2\s\d+\.\d+).*/i

I have to add, that I'm not sure if this actually fits 100% into Splunk. If you want to extract a field via props.conf it would be something like this:

EXTRACT-major_version = DB2\s(?P<major_version>\d+\.\d+).*

To use a regex inline in a search it would be

... |rex "DB2\s(?<major_version>\d+\.\d+).*"

[aljohnson_splun · Accepted solution]

Try this:

| rex "DB2(?<version>\s\d+\.\d+)"

it will be non permanent. and only exist for the single search.

---

Based on the fact that this is relatively simple regular expression, I will leave some links here to help you learn.

1. http://regexone.com/ - this is a great interactive tutorial
2. https://regex101.com/ - test out your regex ! example: https://regex101.com/r/eF7oF2/1
3. Splunk Regular Expressions - docs are great
4. Regular Expression Tutorial

[vinay4444]

index=XXXX  | rex field=databaseDbServerVersion "DB2(?\s\d+\.\d+)" | table version

Thanks version now has correct result 10.1,10.5 etc but is there a way to get DB2 10.1 , DB2 9.7 in version

[aljohnson_splun]

Just change

"DB2(?<version>\s\d+\.\d+)"

to

"(?<version>DB2\s\d+\.\d+)"

Everything inside of the parenthesis is going to be "captured". Everything outside of the parenthesis is going to be "matched".

[sundareshr]

Try this

(\w+\s\d+\.\d+)

[vinay4444]

index=XXXX | rex field=databaseDbServerVersion "DB2(?\s\d+.\d+)" | table version

Thanks version now has correct result 10.1,10.5 etc but is there a way to get DB2 10.1 , DB2 9.7 in version

[sundareshr]

(\w+\s\d+\.\d+) will give you exactly what you asked for.